../SP800-53/SP800-53-HIGH-baseline.xml ➭ Included: Control ac.1 Control ac.2 Subcontrol ac.2.1. Subcontrol ac.2.2. Subcontrol ac.2.3. Subcontrol ac.2.4. Subcontrol ac.2.5. Subcontrol ac.2.11. Subcontrol ac.2.12. Subcontrol ac.2.13. Control ac.3 Control ac.4 Control ac.5 Control ac.6 Subcontrol ac.6.1. Subcontrol ac.6.2. Subcontrol ac.6.3. Subcontrol ac.6.5. Subcontrol ac.6.9. Subcontrol ac.6.10. Control ac.7 Control ac.8 Control ac.10 Control ac.11 Subcontrol ac.11.1. Control ac.12 Control ac.14 Control ac.17 Subcontrol ac.17.1. Subcontrol ac.17.2. Subcontrol ac.17.3. Subcontrol ac.17.4. Control ac.18 Subcontrol ac.18.1. Subcontrol ac.18.4. Subcontrol ac.18.5. Control ac.19 Subcontrol ac.19.5. Control ac.20 Subcontrol ac.20.1. Subcontrol ac.20.2. Control ac.21 Control ac.22 Control at.1 Control at.2 Subcontrol at.2.2. Control at.3 Control at.4 Control au.1 Control au.2 Subcontrol au.2.3. Control au.3 Subcontrol au.3.1. Subcontrol au.3.2. Control au.4 Control au.5 Subcontrol au.5.1. Subcontrol au.5.2. Control au.6 Subcontrol au.6.1. Subcontrol au.6.3. Subcontrol au.6.5. Subcontrol au.6.6. Control au.7 Subcontrol au.7.1. Control au.8 Subcontrol au.8.1. Control au.9 Subcontrol au.9.2. Subcontrol au.9.3. Subcontrol au.9.4. Control au.10 Control au.11 Control au.12 Subcontrol au.12.1. Subcontrol au.12.3. Control ca.1 Control ca.2 Subcontrol ca.2.1. Subcontrol ca.2.2. Control ca.3 Subcontrol ca.3.5. Control ca.5 Control ca.6 Control ca.7 Subcontrol ca.7.1. Control ca.8 Control ca.9 Control cm.1 Control cm.2 Subcontrol cm.2.1. Subcontrol cm.2.2. Subcontrol cm.2.3. Subcontrol cm.2.7. Control cm.3 Subcontrol cm.3.1. Subcontrol cm.3.2. Control cm.4 Subcontrol cm.4.1. Control cm.5 Subcontrol cm.5.1. Subcontrol cm.5.2. Subcontrol cm.5.3. Control cm.6 Subcontrol cm.6.1. Subcontrol cm.6.2. Control cm.7 Subcontrol cm.7.1. Subcontrol cm.7.2. Subcontrol cm.7.5. Control cm.8 Subcontrol cm.8.1. Subcontrol cm.8.2. Subcontrol cm.8.3. Subcontrol cm.8.4. Subcontrol cm.8.5. Control cm.9 Control cm.10 Control cm.11 Control cp.1 Control cp.2 Subcontrol cp.2.1. Subcontrol cp.2.2. Subcontrol cp.2.3. Subcontrol cp.2.4. Subcontrol cp.2.5. Subcontrol cp.2.8. Control cp.3 Subcontrol cp.3.1. Control cp.4 Subcontrol cp.4.1. Subcontrol cp.4.2. Control cp.6 Subcontrol cp.6.1. Subcontrol cp.6.2. Subcontrol cp.6.3. Control cp.7 Subcontrol cp.7.1. Subcontrol cp.7.2. Subcontrol cp.7.3. Subcontrol cp.7.4. Control cp.8 Subcontrol cp.8.1. Subcontrol cp.8.2. Subcontrol cp.8.3. Subcontrol cp.8.4. Control cp.9 Subcontrol cp.9.1. Subcontrol cp.9.2. Subcontrol cp.9.3. Subcontrol cp.9.5. Control cp.10 Subcontrol cp.10.2. Subcontrol cp.10.4. Control ia.1 Control ia.2 Subcontrol ia.2.1. Subcontrol ia.2.2. Subcontrol ia.2.3. Subcontrol ia.2.4. Subcontrol ia.2.8. Subcontrol ia.2.9. Subcontrol ia.2.11. Subcontrol ia.2.12. Control ia.3 Control ia.4 Control ia.5 Subcontrol ia.5.1. Subcontrol ia.5.2. Subcontrol ia.5.3. Subcontrol ia.5.11. Control ia.6 Control ia.7 Control ia.8 Subcontrol ia.8.1. Subcontrol ia.8.2. Subcontrol ia.8.3. Subcontrol ia.8.4. Control ir.1 Control ir.2 Subcontrol ir.2.1. Subcontrol ir.2.2. Control ir.3 Subcontrol ir.3.2. Control ir.4 Subcontrol ir.4.1. Subcontrol ir.4.4. Control ir.5 Subcontrol ir.5.1. Control ir.6 Subcontrol ir.6.1. Control ir.7 Subcontrol ir.7.1. Control ir.8 Control ma.1 Control ma.2 Subcontrol ma.2.2. Control ma.3 Subcontrol ma.3.1. Subcontrol ma.3.2. Subcontrol ma.3.3. Control ma.4 Subcontrol ma.4.2. Subcontrol ma.4.3. Control ma.5 Subcontrol ma.5.1. Control ma.6 Control mp.1 Control mp.2 Control mp.3 Control mp.4 Control mp.5 Subcontrol mp.5.4. Control mp.6 Subcontrol mp.6.1. Subcontrol mp.6.2. Subcontrol mp.6.3. Control mp.7 Subcontrol mp.7.1. Control pe.1 Control pe.2 Control pe.3 Subcontrol pe.3.1. Control pe.4 Control pe.5 Control pe.6 Subcontrol pe.6.1. Subcontrol pe.6.4. Control pe.8 Subcontrol pe.8.1. Control pe.9 Control pe.10 Control pe.11 Subcontrol pe.11.1. Control pe.12 Control pe.13 Subcontrol pe.13.1. Subcontrol pe.13.2. Subcontrol pe.13.3. Control pe.14 Control pe.15 Subcontrol pe.15.1. Control pe.16 Control pe.17 Control pe.18 Control pl.1 Control pl.2 Subcontrol pl.2.3. Control pl.4 Subcontrol pl.4.1. Control pl.8 Control ps.1 Control ps.2 Control ps.3 Control ps.4 Subcontrol ps.4.2. Control ps.5 Control ps.6 Control ps.7 Control ps.8 Control ra.1 Control ra.2 Control ra.3 Control ra.5 Subcontrol ra.5.1. Subcontrol ra.5.2. Subcontrol ra.5.4. Subcontrol ra.5.5. Control sa.1 Control sa.2 Control sa.3 Control sa.4 Subcontrol sa.4.1. Subcontrol sa.4.2. Subcontrol sa.4.9. Subcontrol sa.4.10. Control sa.5 Control sa.8 Control sa.9 Subcontrol sa.9.2. Control sa.10 Control sa.11 Control sa.12 Control sa.15 Control sa.16 Control sa.17 Control sc.1 Control sc.2 Control sc.3 Control sc.4 Control sc.5 Control sc.7 Subcontrol sc.7.3. Subcontrol sc.7.4. Subcontrol sc.7.5. Subcontrol sc.7.7. Subcontrol sc.7.8. Subcontrol sc.7.18. Subcontrol sc.7.21. Control sc.8 Subcontrol sc.8.1. Control sc.10 Control sc.12 Subcontrol sc.12.1. Control sc.13 Control sc.15 Control sc.17 Control sc.18 Control sc.19 Control sc.20 Control sc.21 Control sc.22 Control sc.23 Control sc.24 Control sc.28 Control sc.39 Control si.1 Control si.2 Subcontrol si.2.1. Subcontrol si.2.2. Control si.3 Subcontrol si.3.1. Subcontrol si.3.2. Control si.4 Subcontrol si.4.2. Subcontrol si.4.4. Subcontrol si.4.5. Control si.5 Subcontrol si.5.1. Control si.6 Control si.7 Subcontrol si.7.1. Subcontrol si.7.2. Subcontrol si.7.5. Subcontrol si.7.7. Subcontrol si.7.14. Control si.8 Subcontrol si.8.1. Subcontrol si.8.2. Control si.10 Control si.11 Control si.12 Control si.16 Parameter (organization-defined personnel or roles): organization-defined personnel or roles Parameter (organization-defined frequency): at least annually Parameter (organization-defined frequency): at least annually or whenever a significant change occurs Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined information system account types): organization-defined information system account types Parameter (organization-defined personnel or roles): organization-defined personnel or roles Parameter (organization-defined procedures or conditions): organization-defined procedures or conditions Parameter (organization-defined frequency): monthly for privileged accessed, every six (6) months for non-privileged access Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined time period for each type of account): 24 hours from last use Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined time period): 35 days for user accounts Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 AC-2 (3) Requirement: The service provider defines the time period for non-user accounts (e.g., accounts associated with devices). The time periods are approved and accepted by the JAB/AO. Where user management is a function of the service, reports of activity of consumer users shall be made available. Parameter (organization-defined personnel or roles): organization and/or service provider system owner Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined time-period of expected inactivity or description of when to log out): inactivity is anticipated to exceed Fifteen (15) minutes Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 AC-2 (5) Guidance: Should use a shorter timeframe than AC-12. Parameter (organization-defined circumstances and/or usage conditions): organization-defined circumstances and/or usage conditions Parameter (organization-defined information system accounts): organization-defined information system accounts NIST added this control to the NIST High Baseline during the 1/15/2015 Parameter (organization-defined atypical usage): organization-defined atypical usage Parameter (organization-defined personnel or roles): at a minimum, the ISSO and/or similar role within the organization Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 AC-2 (12)(a) Guidance: Required for privileged accounts. AC-2 (12)(b) Guidance: Required for privileged accounts. Parameter (organization-defined time period): one (1) hour Included in NIST High Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined information flow control policies): organization-defined information flow control policies Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined duties of individuals): organization-defined duties of individuals Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 AC-5 Guidance: CSPs have the option to provide a separation of duties matrix as an attachment to the SSP. Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined security functions (deployed in hardware, software, and firmware) and security-relevant information): all functions not publicly accessible and all security-relevant information not publicly available Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined security functions or security-relevant information): all security functions Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 AC-6 (2) Guidance: Examples of security functions include but are not limited to: establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters, system programming, system and security administration, other privileged functions. Parameter (organization-defined privileged commands): all privileged commands Parameter (organization-defined compelling operational needs): organization-defined compelling operational needs Included in NIST High Baseline, Rev 4 Parameter (organization-defined personnel or roles): organization-defined personnel or roles Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined number): not more than three (3) Parameter (organization-defined time period): fifteen (15) minutes Parameter (organization-defined time period): organization-defined time period Parameter (organization-defined delay algorithm): locks the account/node for a minimum of three (3) hours or until unlocked by an administrator Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined system use notification message or banner): [see additional Requirements and Guidance] Parameter (organization-defined conditions): [see additional Requirements and Guidance] Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 AC-8 Requirement: The service provider shall determine elements of the cloud environment that require the System Use Notification control. The elements of the cloud environment that require System Use Notification are approved and accepted by the JAB/AO. Requirement: The service provider shall determine how System Use Notification is going to be verified and provide appropriate periodicity of the check. The System Use Notification verification and periodicity are approved and accepted by the JAB/AO. Guidance: If performed as part of a Configuration Baseline check, then the % of items requiring setting that are checked and that pass (or fail) check can be provided. Requirement: If not performed as part of a Configuration Baseline check, then there must be documented agreement on how to provide results of verification and the necessary periodicity of the verification by the service provider. The documented agreement on how to provide verification of the results are approved and accepted by the JAB/AO. Parameter (organization-defined account and/or account type): organization-defined account and/or account type Parameter (organization-defined number): three (3) sessions for privileged access and two (2) sessions for non-privileged access Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined time period): fifteen (15) minutes Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined conditions or trigger events requiring session disconnect): organization-defined conditions or trigger events requiring session disconnect Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined user actions): organization-defined user actions Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined number): organization-defined number Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined needs): organization-defined needs Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 Included in NIST High Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined mobile devices): organization-defined mobile devices Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined information sharing circumstances where user discretion is required): organization-defined information sharing circumstances where user discretion is required Parameter (organization-defined automated mechanisms or manual processes): organization-defined automated mechanisms or manual processes Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined frequency): at least quarterly Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined personnel or roles): organization-defined personnel or roles Parameter (organization-defined frequency): at least annually or whenever a significant change occurs Parameter (organization-defined frequency): at least annually or whenever a significant change occurs Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined frequency): at least annually Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined frequency): at least annually Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined time period): five (5) years or 5 years after completion of a specific training program Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined personnel or roles): organization-defined personnel or roles Parameter (organization-defined frequency): at least annually Parameter (organization-defined frequency): at least annually or whenever a significant change occurs Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined auditable events): successful and unsuccessful account logon events, account management events, object access, policy change, privilege functions, process tracking, and system events. For Web applications: all administrator activity, authentication checks, authorization checks, data deletions, data access, data changes, and permission changes Parameter (organization-defined audited events (the subset of the auditable events defined in AU-2 a.) along with the frequency of (or situation requiring) auditing for each identified event): organization-defined subset of the auditable events defined in AU-2a to be audited continually for each identified event Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 AU-2 Requirement: Coordination between service provider and consumer shall be documented and accepted by the JAB/AO. Parameter (organization-defined frequency): annually or whenever there is a change in the threat environment Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 AU-2 (3) Guidance: Annually or whenever changes in the threat environment are communicated to the service provider by the JAB/AO. Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined additional, more detailed information): session, connection, transaction, or activity duration; for client-server transactions, the number of bytes received and bytes sent; additional informational messages to diagnose or identify the event; characteristics that describe or identify the object or resource being acted upon; individual identities of group account users; full-text of privileged commands Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 AU-3 (1) Guidance: For client-server transactions, the number of bytes sent and received gives bidirectional transfer information that can be helpful during an investigation or inquiry. Parameter (organization-defined information system components): all network, data storage, and computing devices Included in NIST High Baseline, Rev 4 Parameter (organization-defined audit record storage requirements): organization-defined audit record storage requirements Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined personnel or roles): organization-defined personnel or roles Parameter (organization-defined actions to be taken (e.g., shut down information system, overwrite oldest audit records, stop generating audit records)): organization-defined actions to be taken (overwrite oldest record) Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined personnel, roles, and/or locations): organization-defined personnel, roles, and/or locations Parameter (organization-defined time period): organization-defined time period Parameter (organization-defined percentage): organization-defined percentage Included in NIST High Baseline, Rev 4 Parameter (organization-defined real-time period): real-time Parameter (organization-defined personnel, roles, and/or locations): service provider personnel with authority to address failed audit events Parameter (organization-defined audit failure events requiring real-time alerts): audit failure events requiring real-time alerts, as defined by organization audit policy Included in NIST High Baseline, Rev 4 Parameter (organization-defined frequency): at least weekly Parameter (organization-defined inappropriate or unusual activity): organization-defined inappropriate or unusual activity Parameter (organization-defined personnel or roles): organization-defined personnel or roles Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 AU-6 Requirement: Coordination between service provider and consumer shall be documented and accepted by the JAB/AO. In multi-tennant environments, capability and means for providing review, analysis, and reporting to consumer for data pertaining to consumer shall be documented. Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined data/information collected from other sources): Selection (one or more): vulnerability scanning information; performance data; information system monitoring information; penetration test data Included in NIST High Baseline, Rev 4 Included in NIST High Baseline, Rev 4 AU-6 (6) Requirement: Coordination between service provider and consumer shall be documented and accepted by the JAB/AO. Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined audit fields within audit records): organization-defined audit fields within audit records Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined granularity of time measurement): one second granularity of time measurement Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined frequency): organization-defined frequency Parameter (organization-defined authoritative time source): http://tf.nist.gov/tf-cgi/servers.cgi Parameter (organization-defined time period): At least hourly Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 AU-8 (1) Requirement: The service provider selects primary and secondary time servers used by the NIST Internet time service. The secondary server is selected from a different geographic region than the primary server. AU-8 (1) Requirement: The service provider synchronizes the system clocks of network computers that run operating systems other than Windows to the Windows Server Domain Controller emulator or to the same time source for that server. AU-8 (1) Guidance: Synchronization of system clocks improves the accuracy of log analysis. Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined frequency): at least weekly Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 Parameter (organization-defined subset of privileged users): organization-defined subset of privileged users Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined actions to be covered by non-repudiation): minimum actions including the addition, modification, deletion, approval, sending, or receiving of data Included in NIST High Baseline, Rev 4 Parameter (organization-defined time period consistent with records retention policy): at least one (1) year Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 AU-11 Requirement: The service provider retains audit records on-line for at least ninety days and further preserves audit records off-line for a period that is in accordance with NARA requirements. Parameter (organization-defined information system components): organization-defined information system components Parameter (organization-defined personnel or roles): all information system and network components where audit capability is deployed/available Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined information system components): all network, data storage, and computing devices Parameter (organization-defined level of tolerance for the relationship between time stamps of individual records in the audit trail): organization-defined level of tolerance for the relationship between time stamps of individual records in the audit trail Non-repudiation Parameter (organization-defined individuals or roles): service provider-defined individuals or roles with audit configuration responsibilities Parameter (organization-defined information system components): all network, data storage, and computing devices Parameter (organization-defined selectable event criteria): organization-defined selectable event criteria Parameter (organization-defined time thresholds): organization-defined time thresholds Non-repudiation Parameter (organization-defined personnel or roles): organization-defined personnel or roles Parameter (organization-defined frequency): at least annually Parameter (organization-defined frequency): at least annually or whenever a significant change occurs Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined frequency): at least annually Parameter (organization-defined individuals or roles): individuals or roles to include FedRAMP PMO Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined level of independence): organization-defined level of independence Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 CA-2 (1) Requirement: For JAB Authorization, must use an accredited 3PAO. Parameter (organization-defined frequency): at least annually Parameter (organization-defined other forms of security assessment): organization-defined other forms of security assessment Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 CA-2 (2) Requirement: To include 'announced', 'vulnerability scanning' Parameter (organization-defined frequency): At least annually and on input from FedRAMP Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined information systems): any systems Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 CA-3 (5) Guidance: For JAB Authorization, CSPs shall include details of this control in their Architecture Briefing Parameter (organization-defined frequency): at least monthly Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 CA-5 Guidance: Requirement: POA&Ms must be provided at least monthly. Parameter (organization-defined frequency): at least every three (3) years or when a significant change occurs Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 CA-6 (c) Guidance: Significant change is defined in NIST Special Publication 800-37 Revision 1, Appendix F. The service provider describes the types of changes to the information system or the environment of operations that would impact the risk posture. The types of changes are approved and accepted by the JAB/AO. Parameter (organization-defined metrics): organization-defined metrics Parameter (organization-defined frequencies): organization-defined frequencies Parameter (organization-defined frequencies): organization-defined frequencies Parameter (organization-defined personnel or roles): organization-defined personnel or roles Parameter (organization-defined frequency): organization-defined frequency Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 CA-7 Requirement: Operating System Scans: at least monthlyDatabase and Web Application Scans: at least monthlyAll scans performed by Independent Assessor: at least annuallyCA-7 Guidance: CSPs must provide evidence of closure and remediation of high vulnerabilities within the timeframe for standard POA&M updates.Operating System Scans: at least monthlyDatabase and Web Application Scans: at least monthlyAll scans performed by Independent Assessor: at least annually Parameter (organization-defined level of independence): organization-defined level of independence Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined frequency): at least annually Parameter (organization-defined information systems or system components): organization-defined information systems or system components Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined information system components or classes of components): organization-defined information system components or classes of components Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined personnel or roles): organization-defined personnel or roles Parameter (organization-defined frequency): at least annually Parameter (organization-defined frequency): at least annually or whenever a significant change occurs Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined frequency): at least annually or when a significant change occurs Parameter (Assignment organization-defined circumstances): to include when directed by the JAB Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 CM-2 (1) (a) Guidance: Significant change is defined in NIST Special Publication 800-37 Revision 1, Appendix F, page F-7. Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined previous versions of baseline configurations of the information system): organization-defined previous versions of baseline configurations of the previously approved baseline configuration of IS components Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined information systems, system components, or devices): organization-defined information systems, system components, or devices Parameter (organization-defined configurations): organization-defined configurations Parameter (organization-defined security safeguards): organization-defined security safeguards Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined time period): organization-defined time period Parameter (organization-defined configuration change control element (e.g., committee, board)): organization-defined configuration change control element (e.g., committee, board) Parameter (organization-defined frequency): organization-defined frequency Parameter (organization-defined configuration change conditions): organization-defined configuration change conditions Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 CM-3 Requirement: The service provider establishes a central means of communicating major changes to or developments in the information system or environment of operations that may affect its services to the federal government and associated service consumers (e.g., electronic bulletin board, web status page). The means of communication are approved and accepted by the JAB/AO.CM-3 (e) Guidance: In accordance with record retention policies and procedures. Parameter (organized-defined approval authorities): organized-defined approval authorities Parameter (organization-defined time period): organization agreed upon time period Parameter (organization-defined personnel): organization defined configuration management approval authorities Included in NIST High Baseline, Rev 4 Included in NIST High Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined frequency): at least every thirty (30) days Parameter (organization-defined circumstances): organization-defined circumstances Included in NIST High Baseline, Rev 4 Parameter (organization-defined software and firmware components): organization-defined software and firmware components Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 CM-5 (3) Guidance: If digital signatures/certificates are unavailable, alternative cryptographic integrity checks (hashes, self-signed certs, etc.) can be utilized. Parameter (organization-defined security configuration checklists): United States Government Configuration Baseline (USGCB) Parameter (organization-defined information system components): organization-defined information system components Parameter (organization-defined operational requirements): organization-defined operational requirements Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 CM-6 (a)-1 Requirement 1: The service provider shall use the Center for Internet Security guidelines (Level 1) to establish configuration settings or establishes its own configuration settings if USGCB is not available. CM-6 (a)-2 Requirement 2: The service provider shall ensure that checklists for configuration settings are Security Content Automation Protocol (SCAP) validated or SCAP compatible (if validated checklists are not available). CM-6 (a) Guidance: Information on the USGCB checklists can be found at: http://usgcb.nist.gov/usgcb_faq.html#usgcbfaq_usgcbfdcc Parameter (organization-defined information system components): organization-defined information system components Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined security safeguards): organization-defined security safeguards Parameter (organization-defined configuration settings): organization-defined configuration settings Included in NIST High Baseline, Rev 4 Parameter (organization-defined prohibited or restricted functions, ports, protocols, and/or services): [United States Government Configuration Baseline (USGCB)] Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 CM-7 (b) Requirement: The service provider shall use the Center for Internet Security guidelines (Level 1) to establish list of prohibited or restricted functions, ports, protocols, and/or services or establishes its own list of prohibited or restricted functions, ports, protocols, and/or services if USGCB is not available.CM-7 Guidance: Information on the USGCB checklists can be found at: http://usgcb.nist.gov/usgcb_faq.html#usgcbfaq_usgcbfdcc. (Partially derived from AC-17(8). Parameter (organization-defined frequency): at least monthly Parameter (organization-defined functions, ports, protocols, and services within the information system deemed to be unnecessary and/or nonsecure): organization-defined functions, ports, protocols, and services within the information system deemed to be unnecessary and/or nonsecure Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined policies regarding software program usage and restrictions): organization-defined policies regarding software program usage and restrictions Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 CM-7 (2) Guidance: This control shall be implemented in a technical manner on the information system to only allow programs to run that adhere to the policy (i.e. white listing). This control is not to be based off of strictly written policy on what is allowed or not allowed to run. Parameter (organization-defined software programs authorized to execute on the information system): organization-defined software programs authorized to execute on the information system Parameter (organization-defined frequency): at least quarterly or when there is a change Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined information deemed necessary to achieve effective information system component accountability): organization-defined information deemed necessary to achieve effective information system component accountability Parameter (organization-defined frequency): at least monthly Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 CM-8 Requirement: must be provided at least monthly or when there is a change. Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 Parameter (organization-defined frequency): Continuously, using automated mechanisms with a maximum five-minute delay in detection. Parameter (organization-defined personnel or roles): organization-defined personnel or roles Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined policies): organization-defined policies Parameter (organization-defined methods): organization-defined methods Parameter (organization-defined frequency): Continuously (via CM-7 (5)) Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined personnel or roles): organization-defined personnel or roles Parameter (organization-defined frequency): at least annually Parameter (organization-defined frequency): at least annually or whenever a significant change occurs Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined personnel or roles): organization-defined personnel or roles Parameter (organization-defined key contingency personnel (identified by name and/or by role) and organizational elements): organization-defined key contingency personnel (identified by name and/or by role) and organizational elements Parameter (organization-defined frequency): at least annually Parameter (organization-defined key contingency personnel (identified by name and/or by role) and organizational elements): organization-defined key contingency personnel (identified by name and/or by role) and organizational elements Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 CP-2 Requirement: For JAB authorizations the contingency lists include designated FedRAMP personnel. Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined time period): organization-defined time period Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined time period): time period defined in service provider and organization SLA Included in NIST High Baseline, Rev 4 Included in NIST High Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined time period): ten (10) days Parameter (organization-defined frequency): at least annually Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 Parameter (organization-defined frequency): at least annually Parameter (organization-defined tests): functional exercises Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 CP-4 (a) Requirement: The service provider develops test plans in accordance with NIST Special Publication 800-34 (as amended); plans are approved by the JAB/AO prior to initiating testing. Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined information system operations): organization-defined information system operations Parameter (organization-defined time period consistent with recovery time and recovery point objectives): organization-defined time period consistent with recovery time and recovery point objectives Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 CP-7 (a) Requirement: The service provider defines a time period consistent with the recovery time objectives and business impact analysis. Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 CP-7 (1) Guidance: The service provider may determine what is considered a sufficient degree of separation between the primary and alternate processing sites, based on the types of threats that are of concern. For one particular type of threat (i.e., hostile cyber attack), the degree of separation between sites will be less relevant. Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 Parameter (organization-defined information system operations): organization-defined information system operations Parameter (organization-defined time period): organization-defined time period Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 CP-8 Requirement: The service provider defines a time period consistent with the recovery time objectives and business impact analysis. Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 Parameter (organization-defined frequency): organization-defined frequency Included in NIST High Baseline, Rev 4 CP-8 (4) (c) [annually] Parameter (organization-defined frequency consistent with recovery time and recovery point objectives): organization-defined frequency consistent with recovery time and recovery point objectives Parameter (organization-defined frequency consistent with recovery time and recovery point objectives): organization-defined frequency consistent with recovery time and recovery point objectives Parameter (organization-defined frequency consistent with recovery time and recovery point objectives): organization-defined frequency consistent with recovery time and recovery point objectives Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 CP-9 (a) [daily incremental; weekly full] CP-9 (b) [daily incremental; weekly full] CP-9 (c) [daily incremental; weekly full] CP-9 Requirement: The service provider shall determine what elements of the cloud environment require the Information System Backup control. The service provider shall determine how Information System Backup is going to be verified and appropriate periodicity of the check. CP-9 (a) Requirement: The service provider maintains at least three backup copies of user-level information (at least one of which is available online) or provides an equivalent alternative. CP-9 (b) Requirement: The service provider maintains at least three backup copies of system-level information (at least one of which is available online) or provides an equivalent alternative. CP-9 (c) Requirement: The service provider maintains at least three backup copies of information system documentation including security information (at least one of which is available online) or provides an equivalent alternative. Parameter (organization-defined frequency): organization-defined frequency Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 CP-9 (1). [at least monthly] Included in NIST High Baseline, Rev 4 Parameter (organization-defined critical information system software and other security-related information): organization-defined critical information system software and other security-related information Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined time period and transfer rate consistent with the recovery time and recovery point objectives): organization-defined time period and transfer rate consistent with the recovery time and recovery point objectives Included in NIST High Baseline, Rev 4 CP-9 (5) [time period and transfer rate consistent with the recovery time and recovery point objectives defined in the service provider and organization SLA]. Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined restoration time-periods): organization-defined restoration time-periods Included in NIST High Baseline, Rev 4 CP-10 (4) [time period consistent with the restoration time-periods defined in the service provider and organization SLA] Parameter (organization-defined personnel or roles): organization-defined personnel or roles Parameter (organization-defined frequency): organization-defined frequency Parameter (organization-defined frequency): organization-defined frequency Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 IA-1 (b) (1) [at least annually] IA-1 (b) (2) [at least annually or whenever a significant change occurs] Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 Parameter (organization-defined strength of mechanism requirements): organization-defined strength of mechanism requirements Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 IA-2 (11) [FIPS 140-2, NIAP Certification, or NSA approval] IA-2 (11) Guidance: PIV=separate device. Please refer to NIST SP 800-157 Guidelines for Derived Personal Identity Verification (PIV) Credentials. Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 IA-2 (12) Guidance: Include Common Access Card (CAC), i.e., the DoD technical implementation of PIV/FIPS 201/HSPD-12. Parameter (organization-defined specific and/or types of devices): organization-defined specific and/or types of devices Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined personnel or roles): organization-defined personnel or roles Parameter (organization-defined time period): organization-defined time period Parameter (organization-defined time period of inactivity): organization-defined time period of inactivity Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 IA-4(a) [at a minimum, the ISSO (or similar role within the organization)] IA-4 (d) [at least two (2) years] IA-4 (e) [thirty-five (35) days] (See additional requirements and guidance.) IA-4 (e) Requirement: The service provider defines the time period of inactivity for device identifiers. Guidance: For DoD clouds, see DoD cloud website for specific DoD requirements that go above and beyond FedRAMP http://iase.disa.mil/cloud_security/Pages/index.aspx. Parameter (organization-defined time period by authenticator type): organization-defined time period by authenticator type Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 IA-5 (g) [to include sixty (60) days for passwords] IA-5 Requirement: Authenticators must be compliant with NIST SP 800-63-2 Electronic Authentication Guideline assurance Level 4 (Link http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63-2.pdf) Parameter (organization-defined requirements for case sensitivity, number of characters, mix of upper-case letters, lower-case letters, numbers, and special characters, including minimum requirements for each type): organization-defined requirements for case sensitivity, number of characters, mix of upper-case letters, lower-case letters, numbers, and special characters, including minimum requirements for each type Parameter (organization-defined number): organization-defined number Parameter (organization-defined numbers for lifetime minimum, lifetime maximum): organization-defined numbers for lifetime minimum, lifetime maximum Parameter (organization-defined number): organization-defined number Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 IA-5 (1) (a) [case sensitive, minimum of fourteen (14) characters, and at least one (1) each of upper-case letters, lower-case letters, numbers, and special characters] IA-5 (1) (b) [at least fifty percent (50%)] IA-5 (1) (d) [one (1) day minimum, sixty (60) day maximum] IA-5 (1) (e) [twenty four (24)] Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined types of and/or specific authenticators): organization-defined types of and/or specific authenticators Parameter (organization-defined registration authority): organization-defined registration authority Parameter (organization-defined personnel or roles): organization-defined personnel or roles Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 IA-5 (3)-1 [All hardware/biometric (multifactor authenticators] IA-5 (3)-2 [in person] Parameter (organization-defined token quality requirements): organization-defined token quality requirements Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 IDENTIFICATION AND AUTHENTICATION (NON- ORGANIZATIONAL USERS) Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined information systems): organization-defined information systems Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined personnel or roles): organization-defined personnel or roles Parameter (organization-defined frequency): organization-defined frequency Parameter (organization-defined frequency): organization-defined frequency Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 IR-1 (b) (1) [at least annually] IR-1 (b) (2) [at least annually or whenever a significant change occurs] Parameter (organization-defined time period): organization-defined time period Parameter (organization-defined frequency): organization-defined frequency Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 IR-2 (a) [within ten (10) days] IR-2 (c) [at least annually] Included in NIST High Baseline, Rev 4 Included in NIST High Baseline, Rev 4 Parameter (organization-defined frequency): organization-defined frequency Parameter (organization-defined tests): organization-defined tests Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 IR-3-1 [at least every six (6) months] IR-3-2 Requirement: The service provider defines tests and/or exercises in accordance with NIST Special Publication 800-61 (as amended). For JAB authorization, the service provider provides test plans to the JAB/AO annually. Test plans are approved and accepted by the JAB/AO prior to test commencing. Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 IR-4 Requirement: The service provider ensures that individuals conducting incident handling meet personnel security requirements commensurate with the criticality/sensitivity of the information being processed, stored, and transmitted by the information system. Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 Parameter (organization-defined time period): organization-defined time period Parameter (organization-defined authorities): organization-defined authorities Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 IR-6 (a) [US-CERT incident reporting timelines as specified in NIST Special Publication 800-61 (as amended)] IR-6 Requirement: Reports security incident information according to FedRAMP Incident Communications Procedure. Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined personnel or roles): organization-defined personnel or roles Parameter (organization-defined incident response personnel (identified by name and/or by role) and organizational elements): organization-defined incident response personnel (identified by name and/or by role) and organizational elements Parameter (organization-defined frequency): organization-defined frequency Parameter (organization-defined incident response personnel (identified by name and/or by role) and organizational elements): organization-defined incident response personnel (identified by name and/or by role) and organizational elements Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 IR-8 (b) [see additional FedRAMP Requirements and Guidance] IR-8 (c) [at least annually] IR-8 (e) [see additional FedRAMP Requirements and Guidance] IR-8 (b) Requirement: The service provider defines a list of incident response personnel (identified by name and/or by role) and organizational elements. The incident response list includes designated FedRAMP personnel. IR-8 (e) Requirement: The service provider defines a list of incident response personnel (identified by name and/or by role) and organizational elements. The incident response list includes designated FedRAMP personnel. Parameter (organization-defined personnel or roles): organization-defined personnel or roles Parameter (organization-defined frequency): organization-defined frequency Parameter (organization-defined frequency): organization-defined frequency Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 MA-1 (b) (1) [at least annually] MA-1 (b) (2) [at least annually or whenever a significant change occurs] Parameter (organization-defined personnel or roles): organization-defined personnel or roles Parameter (organization-defined maintenance-related information): organization-defined maintenance-related information Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined personnel or roles): organization-defined personnel or roles Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 MA-3 (3) (d). [the information owner explicitly authorizing removal of the equipment from the facility] Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined information system components): organization-defined information system components Parameter (organization-defined time period): organization-defined time period Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined personnel or roles): organization-defined personnel or roles Parameter (organization-defined frequency): organization-defined frequency Parameter (organization-defined frequency): organization-defined frequency Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 MP-1 (b) (1) [at least annually] MP-1 (b) (2) [at least annually or whenever a significant change occurs] Parameter (organization-defined types of digital and/or non-digital media): organization-defined types of digital and/or non-digital media Parameter (organization-defined personnel or roles): organization-defined personnel or roles Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 MP-2-1 [any digital and non-digital media deemed sensitive] Parameter (organization-defined types of information system media): organization-defined types of information system media Parameter (organization-defined controlled areas): organization-defined controlled areas Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 MP-3 (b)-1 [no removable media types] MP-3 (b)-2 [organization-defined security safeguards not applicable] MP-3 (b) Guidance: Second parameter not-applicable Parameter (organization-defined types of digital and/or non-digital media): organization-defined types of digital and/or non-digital media Parameter (organization-defined controlled areas): organization-defined controlled areas Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 MP-4 (a)-1 [all types of digital and non-digital media with sensitive information] MP-4 (a)-2 [see additional FedRAMP requirements and guidance] MP-4 (a) Requirement: The service provider defines controlled areas within facilities where the information and information system reside. Parameter (organization-defined types of information system media): organization-defined types of information system media Parameter (organization-defined security safeguards): organization-defined security safeguards Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 MP-5 (a) [all media with sensitive information] [prior to leaving secure/controlled environment: for digital media, encryption using a FIPS 140-2 validated encryption module; for non-digital media, secured in locked container] MP-5 (a) Requirement: The service provider defines security measures to protect digital and non-digital media in transport. The security measures are approved and accepted by the JAB. Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined information system media): organization-defined information system media Parameter (organization-defined sanitization techniques and procedures): organization-defined sanitization techniques and procedures Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 MP-6(a)-2 [techniques and procedures IAW NIST SP 800-88 and Section 5.9: Reuse and Disposal of Storage Media and Hardware] Included in NIST High Baseline, Rev 4 Parameter (organization-defined frequency): organization-defined frequency Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 MP-6 (2) [at least every six (6) months] MP-6 (2) Guidance: Equipment and procedures may be tested or validated for effectiveness Parameter (organization-defined circumstances requiring sanitization of portable storage devices): organization-defined circumstances requiring sanitization of portable storage devices Included in NIST High Baseline, Rev 4 Parameter (organization-defined types of information system media): organization-defined types of information system media Parameter (organization-defined information systems or system components): organization-defined information systems or system components Parameter (organization-defined security safeguards): organization-defined security safeguards Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined personnel or roles): organization-defined personnel or roles Parameter (organization-defined frequency): organization-defined frequency Parameter (organization-defined frequency): organization-defined frequency Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 PE-1 (b) (1) [at least annually] PE-1 (b) (2) [at least annually or whenever a significant change occurs] Parameter (organization-defined frequency): organization-defined frequency Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 PE-2 (c) [at least every ninety (90) days] Parameter (organization-defined entry/exit points to the facility where the information system resides): organization-defined entry/exit points to the facility where the information system resides Parameter (organization-defined physical access control systems/devices): organization-defined physical access control systems/devices Parameter (organization-defined entry/exit points): organization-defined entry/exit points Parameter (organization-defined security safeguards): organization-defined security safeguards Parameter (organization-defined circumstances requiring visitor escorts and monitoring): organization-defined circumstances requiring visitor escorts and monitoring Parameter (organization-defined physical access devices): organization-defined physical access devices Parameter (organization-defined frequency): organization-defined frequency Parameter (organization-defined frequency): organization-defined frequency Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 PE-3 (a) (2) [CSP defined physical access control systems/devices AND guards] PE-3 (d) [in all circumstances within restricted access area where the information system resides] PE-3 (f) [at least annually] PE-3 (g) [at least annually] Parameter (organization-defined physical spaces containing one or more components of the information system): organization-defined physical spaces containing one or more components of the information system Included in NIST High Baseline, Rev 4 Parameter (organization-defined information system distribution and transmission lines): organization-defined information system distribution and transmission lines Parameter (organization-defined security safeguards): organization-defined security safeguards Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined frequency): organization-defined frequency Parameter (organization-defined events or potential indications of events): organization-defined events or potential indications of events Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 PE-6 (b) [at least monthly] Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined physical spaces containing one or more components of the information system): organization-defined physical spaces containing one or more components of the information system Included in NIST High Baseline, Rev 4 Parameter (organization-defined time period): organization-defined time period Parameter (organization-defined frequency): organization-defined frequency Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 PE-8 (a) [for a minimum of one (1) year] PE-8 (b) [at least monthly] Included in NIST High Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined location by information system or system component): organization-defined location by information system or system component Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined personnel or roles): organization-defined personnel or roles Parameter (organization-defined emergency responders): organization-defined emergency responders Included in NIST High Baseline, Rev 4 PE-13 (1) -1 [service provider building maintenance/physical security personnel] PE-13 (1) -2 [service provider emergency responders with incident response responsibilities] Parameter (organization-defined emergency responders): organization-defined emergency responders Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined acceptable levels): organization-defined acceptable levels Parameter (organization-defined frequency): organization-defined frequency Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 PE-14 (a) [consistent with American Society of Heating, Refrigerating and Air-conditioning Engineers (ASHRAE) document entitled Thermal Guidelines for Data Processing Environments] PE-14 (b) [continuously] PE-14 (a) Requirements: The service provider measures temperature at server inlets and humidity levels by dew point. Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined personnel or roles): organization-defined personnel or roles Included in NIST High Baseline, Rev 4 PE-15 (1) [service provider building maintenance/physical security personnel] Parameter (organization-defined types of information system components): organization-defined types of information system components Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 PE-16 [all information system components] Parameter (organization-defined security controls): organization-defined security controls Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined physical and environmental hazards): organization-defined physical and environmental hazards Included in NIST High Baseline, Rev 4 PE-18 [physical and environmental hazards identified during threat assessment] Parameter (organization-defined personnel or roles): organization-defined personnel or roles Parameter (organization-defined frequency): organization-defined frequency Parameter (organization-defined frequency): organization-defined frequency Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 PL-1 (b) (1) [at least annually] PL-1 (b) (2) [at least annually or whenever a significant change occurs] Parameter (organization-defined personnel or roles): organization-defined personnel or roles Parameter (organization-defined frequency): organization-defined frequency Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 PL-2 (c) [at least annually] Parameter (organization-defined individuals or groups): organization-defined individuals or groups Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined frequency): organization-defined frequency Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 PL-4 (c) [annually] Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined frequency): organization-defined frequency Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 PL-8 (b) [at least annually or when a significant change occurs] PL-8 (b) Guidance: Significant change is defined in NIST Special Publication 800-37 Revision 1, Appendix F, page F-7. Parameter (organization-defined personnel or roles): organization-defined personnel or roles Parameter (organization-defined frequency): organization-defined frequency Parameter (organization-defined frequency): organization-defined frequency Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 PS-1 (b) (1) [at least annually] PS-1 (b) (2) [at least annually or whenever a significant change occurs] Parameter (organization-defined frequency): organization-defined frequency Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 PS-2 (c) [at least annually] Parameter (organization-defined conditions requiring rescreening and, where rescreening is so indicated, the frequency of such rescreening): organization-defined conditions requiring rescreening and, where rescreening is so indicated, the frequency of such rescreening Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 PS-3 (b) [for national security clearances; a reinvestigation is required during the fifth (5th) year for top secret security clearance, the tenth (10th) year for secret security clearance, and fifteenth (15th) year for confidential security clearance. For moderate risk law enforcement and high impact public trust level, a reinvestigation is required during the fifth (5th) year. There is no reinvestigation for other moderate risk positions or any low risk positions] Parameter (organization-defined time period): organization-defined time period Parameter (organization-defined information security topics): organization-defined information security topics Parameter (organization-defined personnel or roles): organization-defined personnel or roles Parameter (organization-defined time period): organization-defined time period Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 PS-4 (a) [eight (8) hours] Parameter (organization-defined personnel or roles): organization-defined personnel or roles Included in NIST High Baseline, Rev 4 PS-4 (2) [access control personnel responsible for disabling access to the system] Parameter (organization-defined transfer or reassignment actions): organization-defined transfer or reassignment actions Parameter (organization-defined time period following the formal transfer action): organization-defined time period following the formal transfer action Parameter (organization-defined personnel or roles): organization-defined personnel or roles Parameter (organization-defined time period): organization-defined time period Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 PS-5 (b)-2 [twenty-four (24) hours] PS-5 (d)-2 [twenty-four (24) hours] Parameter (organization-defined frequency): organization-defined frequency Parameter (organization-defined frequency): organization-defined frequency Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 PS-6 (b) [at least annually] PS-6 (c) (2) [at least annually and any time there is a change to the user's level of access] Parameter (organization-defined personnel or roles): organization-defined personnel or roles Parameter (organization-defined time period): organization-defined time period Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 PS-7 (d)-2 [terminations: immediately; transfers: within twenty-four (24) hours] Parameter (organization-defined personnel or roles): organization-defined personnel or roles Parameter (organization-defined time period): organization-defined time period Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 PS-8(b)-1 [at a minimum, the ISSO and/or similar role within the organization] Parameter (organization-defined personnel or roles): organization-defined personnel or roles Parameter (organization-defined frequency): organization-defined frequency Parameter (organization-defined frequency): organization-defined frequency Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 RA-1 (b) (1) [at least annually] RA-1 (b) (2) [at least annually or whenever a significant change occurs] Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined document): organization-defined document Parameter (organization-defined frequency): organization-defined frequency Parameter (organization-defined personnel or roles): organization-defined personnel or roles Parameter (organization-defined frequency): organization-defined frequency Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 RA-3 (b) [security assessment report]RA-3 (c) [at least annually or whenever a significant change occurs]RA-3 (e) [annually] RA-3 Guidance: Significant change is defined in NIST Special Publication 800-37 Revision 1, Appendix F. RA-3 (d) Requirement: Include all Authoring Officials and FedRAMP ISSOs. Parameter (organization-defined frequency and/or randomly in accordance with organization-defined process): organization-defined frequency and/or randomly in accordance with organization-defined process Parameter (organization-defined response times): organization-defined response times Parameter (organization-defined personnel or roles): organization-defined personnel or roles Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 RA-5 (a) [monthly operating system/infrastructure; monthly web applications and databases] RA-5 (d) [high-risk vulnerabilities mitigated within thirty (30) days from date of discovery; moderate-risk vulnerabilities mitigated within ninety (90) days from date of discovery] RA-5 (a) Requirement: an accredited independent assessor scans operating systems/infrastructure, web applications, and databases once annually. RA-5 (e) Requirement: to include the Risk Executive; for JAB authorizations to include FedRAMP Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined frequency): organization-defined frequency Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 RA-5 (2) [prior to a new scan] Parameter (organization-defined corrective actions): organization-defined corrective actions Included in NIST High Baseline, Rev 4 RA-5 (4) [notify appropriate service provider personnel and follow procedures for organization and service provider-defined corrective actions] Parameter (organization-identified information system components): organization-identified information system components Parameter (organization-defined vulnerability scanning activities): organization-defined vulnerability scanning activities Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 RA-5 (5)-1 [operating systems / web applications / databases] RA-5 (5)-2 [all scans] Parameter (organization-defined personnel or roles): organization-defined personnel or roles Parameter (organization-defined frequency): organization-defined frequency Parameter (organization-defined frequency): organization-defined frequency Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 SA-1 (b) (1) [at least annually] SA-1 (b) (2) [at least annually or whenever a significant change occurs] Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined system development life cycle): organization-defined system development life cycle Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 SA-4 Guidance: The use of Common Criteria (ISO/IEC 15408) evaluated products is strongly preferred. See http://www.niap-ccevs.org/vpl or http://www.commoncriteriaportal.org/products.html. Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined design/implementation information): organization-defined design/implementation information Parameter (organization-defined level of detail): organization-defined level of detail Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 SA-4 (2)-1 [at a minimum to include security-relevant external system interfaces; high-level design; low-level design; source code or network and data flow diagram; [organization-defined design/implementation information]] Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined actions): organization-defined actions Parameter (organization-defined personnel or roles): organization-defined personnel or roles Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 SA-5E [at a minimum, the ISSO (or similar role within the organization)] Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined security controls): organization-defined security controls Parameter (organization-defined processes, methods, and techniques): organization-defined processes, methods, and techniques Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 SA-9 (a) [FedRAMP Security Controls Baseline(s) if Federal information is processed or stored within the external system] SA-9 (c) [Federal/FedRAMP Continuous Monitoring requirements must be met for external systems where Federal information is processed or stored] Parameter (organization-defined external information system services): organization-defined external information system services Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 SA-9 (2) [all external systems where Federal information is processed or stored] Parameter (organization-defined configuration items under configuration management): organization-defined configuration items under configuration management Parameter (organization-defined personnel): organization-defined personnel Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 SA-10 (a) [development, implementation, AND operation] SA-10 (e) Requirement: for JAB authorizations, track security flaws and flaw resolution within the system, component, or service and report findings to organization-defined personnel, to include FedRAMP. Parameter (organization-defined depth and coverage): organization-defined depth and coverage Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined security safeguards): organization-defined security safeguards Included in NIST High Baseline, Rev 4 SA-12 [organization and service provider-defined personnel security requirements, approved HW/SW vendor list/process, and secure SDLC procedures] Parameter (organization-defined frequency): organization-defined frequency Parameter (organization-defined security requirements): organization-defined security requirements Included in NIST High Baseline, Rev 4 SA-15 (b)-1 [as needed and as dictated by the current threat posture] SA-15 (b)-2 [organization and service provider- defined security requirements] Parameter (organization-defined training): organization-defined training Included in NIST High Baseline, Rev 4 Included in NIST High Baseline, Rev 4 Parameter (organization-defined personnel or roles): organization-defined personnel or roles Parameter (organization-defined frequency): organization-defined frequency Parameter (organization-defined frequency): organization-defined frequency Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 SC-1 (b) (1) [at least annually] SC-1 (b) (2) [at least annually or whenever a significant change occurs] Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined types of denial of service attacks or references to sources for such information): organization-defined types of denial of service attacks or references to sources for such information Parameter (organization-defined security safeguards): organization-defined security safeguards Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined frequency): organization-defined frequency Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 SC-7 (4) (e) [at least every ninety (90) days or whenever there is a change in the threat environment that warrants a review of the exceptions] Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined internal communications traffic): organization-defined internal communications traffic Parameter (organization-defined external networks): organization-defined external networks Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined information system components): organization-defined information system components Parameter (organization-defined missions and/or business functions): organization-defined missions and/or business functions Included in NIST High Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 SC-8 [confidentiality AND integrity] Parameter (organization-defined alternative physical safeguards): organization-defined alternative physical safeguards Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 SC-8 (1)-1 [prevent unauthorized disclosure of information AND detect changes to information] SC-8 (1)-1 [a hardened or alarmed carrier Protective Distribution System (PDS)] Parameter (organization-defined time period): organization-defined time period Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 SC-10 [no longer than ten (10) minutes for privileged sessions and no longer than fifteen (15) minutes for user sessions] Parameter (organization-defined requirements for key generation, distribution, storage, access, and destruction): organization-defined requirements for key generation, distribution, storage, access, and destruction Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 SC-12 Guidance: Federally approved cryptography Included in NIST High Baseline, Rev 4 Parameter (organization-defined cryptographic uses and type of cryptography required for each use): organization-defined cryptographic uses and type of cryptography required for each use Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 SC-13 [FIPS-validated or NSA-approved cryptography] Parameter (organization-defined exceptions where remote activation is to be allowed): organization-defined exceptions where remote activation is to be allowed Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 SC-15 (a) [no exceptions] SC-15 Requirement: The information system provides disablement (instead of physical disconnect) of collaborative computing devices in a manner that supports ease of use. Parameter (organization-defined certificate policy): organization-defined certificate policy Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 SECURE NAME /ADDRESS RESOLUTION SERVICE (AUTHORITATIVE SOURCE) Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 SECURE NAME /ADDRESS RESOLUTION SERVICE (RECURSIVE OR CACHING RESOLVER) Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 ARCHITECTURE AND PROVISIONING FOR NAME/ADDRESS RESOLUTION SERVICE Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined known-state): organization-defined known-state Parameter (organization-defined types of failures): organization-defined types of failures Parameter (organization-defined system state information): organization-defined system state information Included in NIST High Baseline, Rev 4 Parameter (organization-defined information at rest): organization-defined information at rest Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 SC-28 [confidentiality AND integrity] SC-28 Guidance: The organization supports the capability to use cryptographic mechanisms to protect information at rest. Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined personnel or roles): organization-defined personnel or roles Parameter (organization-defined frequency): organization-defined frequency Parameter (organization-defined frequency): organization-defined frequency Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 SI-1 (b) (1) [at least annually] SI-1 (b) (2) [at least annually or whenever a significant change occurs] Parameter (organization-defined time period): organization-defined time period Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 SI-2 (c) [thirty (30) days of release of updates] Included in NIST High Baseline, Rev 4 Parameter (organization-defined frequency): organization-defined frequency Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 SI-2 (2) [at least monthly] Parameter (organization-defined frequency): organization-defined frequency Parameter (organization-defined action): organization-defined action Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 SI-3 (c) (1)-1 [at least weekly] SI-3 (c) (1)-2 [to include endpoints] SI-3 (c) (2) [to include blocking and quarantining malicious code and alerting administrator or defined security personnel near-realtime] Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined monitoring objectives): organization-defined monitoring objectives Parameter (organization-defined techniques and methods): organization-defined techniques and methods Parameter (organization-defined information system monitoring information): organization-defined information system monitoring information Parameter (organization-defined personnel or roles): organization-defined personnel or roles Parameter (organization-defined frequency): organization-defined frequency Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 SI-4 Guidance: See US-CERT Incident Response Reporting Guidelines. Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined frequency): organization-defined frequency Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 SI-4 (4) [continuously] Parameter (organization-defined personnel or roles): organization-defined personnel or roles Parameter (organization-defined compromise indicators): organization-defined compromise indicators Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 SI-4 (5) Guidance: In accordance with the incident response plan. Parameter (organization-defined external organizations): organization-defined external organizations Parameter (organization-defined personnel or roles): organization-defined personnel or roles Parameter (organization-defined elements within the organization): organization-defined elements within the organization Parameter (organization-defined external organizations): organization-defined external organizations Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 SI-5 (a) [to include US-CERT] SI-5 (c) [to include system security personnel and administrators with configuration/patch-management responsibilities] Included in NIST High Baseline, Rev 4 Parameter (organization-defined security functions): organization-defined security functions Parameter (organization-defined system transitional states): organization-defined system transitional states Parameter (organization-defined frequency): organization-defined frequency Parameter (organization-defined personnel or roles): organization-defined personnel or roles Parameter (organization-defined alternative action(s)): organization-defined alternative action(s) Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 SI-6 (b) [to include upon system startup and/or restart and at least monthly] SI-6 (c) [to include system administrators and security personnel] SI-6 (d) [to include notification of system administrators and security personnel] Parameter (organization-defined software, firmware, and information): organization-defined software, firmware, and information Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined software, firmware, and information): organization-defined software, firmware, and information Parameter (organization-defined transitional states or security-relevant events): organization-defined transitional states or security-relevant events Parameter (organization-defined frequency): organization-defined frequency Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 SI-7(1)-1 [selection to include security relevant events] SI-7(1)-2 [at least monthly] Parameter (organization-defined personnel or roles): organization-defined personnel or roles Included in NIST High Baseline, Rev 4 Parameter (organization-defined security safeguards): organization-defined security safeguards Included in NIST High Baseline, Rev 4 Parameter (organization-defined security-relevant changes to the information system): organization-defined security-relevant changes to the information system Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined information inputs): organization-defined information inputs Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined personnel or roles): organization-defined personnel or roles Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4 Parameter (organization-defined security safeguards): organization-defined security safeguards Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4